RFID mutual authentication verification session

Abstract

In a protocol for preserving the privacy of communications between a RFID reader and a RFID tag, two distinct actions are taken. First, the reader and the tag must be mutually authenticated as being authorized participants in the communications. After that process is successfully completed, the authenticity of each authorized participant must be validated prior to each subsequent communication between reader and tag.

Description

FIELD OF THE INVENTION[0001]The present invention relates generally to radio frequency identification (RFID) systems, and, more particularly, to methods of and devices for protecting the security of communications between RFID tags and readers.BACKGROUND OF THE INVENTION[0002]In the most basic terms, RFID systems consist of a RFID tag implemented to provide information stored in the tag pertaining to the identity and perhaps features or characteristics of an object to which the tag is affixed, and to communicate that information via an RF signal to a RFID reader in response to an RF interrogation signal received by the tag from the reader. In most instances of current use, a single reader is used to commence individual communication sessions or transactions with a multiplicity of tags.[0003]Typically, objects bearing the tags are moved past the fixed location of the reader, which is remote from the tags but within the communication range, or response range, of each tag as the tag tr...

AI Technical Summary

Benefits of technology

This protocol provides a simple and efficient method to protect the privacy and security of RFID communications, preventing unauthorized access to sensitive data by ensuring continuous mutual authentication throughout the communication session, applicable to both passive and active tags.

Problems solved by technology

Accordingly, a passive RFID tag is quite limited with respect to the amount of data that can be furnished in its response to a reader's query, usually consisting of only fixed, invariable information stored in the tag, e.g., an ID number and perhaps a small amount of additional data.

The on-board, or on-chip, battery of an active RFID tag can give the tag a greater response range, along with greater accuracy, reliability and data storage capacity, but the active tag has the aforementioned disadvantages of greater cost and size relative to the passive tag.

The battery itself can be quite small, but not enough to overcome the size disadvantage.

There are concerns, however, over potential loss of privacy and theft of personal identity information as a result of the growing use of RFID tags.

In the Vajda article, the desire to provide security in low-cost RFID tags is viewed as challenging because of the highly resource-constrained nature of the tags, and their inability to support strong cryptography.

However, Vajda presents the complexity of requiring two states or modes of operation of the tags, and the distinct possibility that an unauthorized reader could penetrate a tag's defense against acquisition of its secure data by gaining entry through the more open ID mode notwithstanding its designation as the locked state.

In addition, Vajda's use of a list of pseudonyms has problems in the relatively large number of messages required, as well as the cost factor associated with frequent updating of those pseudonym lists and secret keys, and over-reliance on the premise that an unauthorized reader can only observe a limited number of consecutive runs of the protocol.

Such tracking of tagged library books raises the specter of surveillance of library patrons and their reading habits.

Concern over violations of security and privacy of communications between authorized reader and tag may also be present with a passive tag, but the ability to set up equipment that maintains power at the tag via RF energy at all times is much more difficult, albeit possible.

Images